ci: security scanning, with the findings read and justified #2

Merged

marcos-mendez merged 1 commit from ci/security-scan into master

2026-10-07 15:20:31 -03:00

marcos-mendez commented

2026-10-07 14:55:20 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

Baseline from a scan of master, none a risk. bandit B605/B602 and
semgrep's tainted-env rules are in the bundled pylib, whose helpers run
the caller's own command with quoted arguments. mysql.py's shell=True
runs a constant mysql or mysqldump command with debian.cnf. SHA-1 is
an integrity check and fingerprint inside the escrow key packet (the
passphrase key is iterated SHA-256), or shapes random bytes; the
"shadow file" hits are regtest passwd and group files with x
placeholders; the file modes flagged are 0600, 0700 and 0750. Plus 17
shellcheck warnings of existing scripts.

bandit cannot parse 39 files, which are Python 2. gitleaks:
dep-commit-ids lists git commit ids, ignored by fingerprint in
.github/.gitleaksignore.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. Baseline from a scan of master, none a risk. bandit B605/B602 and semgrep's tainted-env rules are in the bundled pylib, whose helpers run the caller's own command with quoted arguments. mysql.py's shell=True runs a constant mysql or mysqldump command with debian.cnf. SHA-1 is an integrity check and fingerprint inside the escrow key packet (the passphrase key is iterated SHA-256), or shapes random bytes; the "shadow file" hits are regtest passwd and group files with x placeholders; the file modes flagged are 0600, 0700 and 0750. Plus 17 shellcheck warnings of existing scripts. bandit cannot parse 39 files, which are Python 2. gitleaks: dep-commit-ids lists git commit ids, ignored by fingerprint in .github/.gitleaksignore.